Such a boiler comprises components that are well known and are referred to below in the description of the present invention. In particular, such a boiler is provided with a protection system which is triggered by excess reactor power, and with a protection system which is triggered by too high a temperature in the cooling fluid. These systems are referred to below as the "excess power system" and the "high temperature system". They are designed to protect the reactor core during certain accidental transients during which they trigger an emergency stop of the reactor. To this end, they generate an emergency stop signal on the basis of measurements of the following parameters:
(a) the temperature difference DT between the hot branch and the cold branch, which difference is representative of the nuclear power, i.e., the heat power of the reactor; PA1 (b) the mean temperature ST of the reactor vessel; PA1 (c) the primary pressure (used only by the high temperature system); PA1 (d) the speed of rotation VP of the primary pumps; (representative of the flow rate of the primary heat exchange fluid); and PA1 (e) the axial power difference DI, i.e., the difference between the power measured at the top of the core and the power measured at the bottom of the core. PA1 (a) the increase in load on the secondary circuit causes more power to be extracted from the primary circuit, thereby reducing the operating temperature ST of the reactor; and PA1 (b) the reactor control system increases the nuclear power in order to keep up with the increased demand from the secondary circuit.
By way of example, the nuclear power limit beyond which one or the other of these two protection systems generates an emergency stop signal is shown in FIG. 3. In FIG. 3, curves JP and KP represent the limit, and apply respectively to constant values of pump speed and to constant values of axial power difference.
A problem arises in the operation of this system. The problem can be described with the help of FIG. 3 where a curve ET shows the typical behavior of an accidental transient due to uncontrolled increase in the load on the secondary heat exchange circuit. This circuit is thermally coupled to the steam generator which constitutes a heat receiver in the primary heat exchange circuit. Two phenomena arise:
An analysis of this type of transient has shown that with a protection system of known design, an emergency stop of the reactor is not guaranteed. With some transients, the safety criteria that guarantee fuel integrity are not satisfied.